From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 5AC6BC433EF for ; Fri, 25 Feb 2022 20:59:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:In-Reply-To:MIME-Version:References: Message-ID:Subject:Cc:To:From:Date:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=HgVvY/dHqsfgp7VgOr/TBZMBWOl84lSyjJp3ODHA6G0=; b=zUd3tnXZrbRXi+ PcVnouNCQLOfd1UBUaOau4FFh5Dqzwz8FuGKPOfHgknhSao1PGce70m/djMCoA67IHvsNVojFaVwZ 4rVEP3alLEvGLd98J+bdk4TKP483he7NcCCw54OMZd+FteKav7v4tGioAkeT+86F8/Xgr+08saQv7 WGv5fbhirp9choojcpm+M8Fd2Al1VhxlVwEoOSQXRmIqAfrCyLnrbaEO+JJYOueC2BySikzq3YKtE 7o7hzlThmo4A3vThyZgb9Gn7n3mN3DyUe4qWo1Mz6g9duPAl6BJ7pkNNM5ySWGOW2tHWMR8V3lw+H 6ER7oaBgHmhY+zGxJdhA==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1nNhfO-006y7J-DP; Fri, 25 Feb 2022 20:58:18 +0000 Received: from mail-pl1-x62c.google.com ([2607:f8b0:4864:20::62c]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1nNhfK-006y6X-1A for linux-arm-kernel@lists.infradead.org; Fri, 25 Feb 2022 20:58:15 +0000 Received: by mail-pl1-x62c.google.com with SMTP id bd1so5765166plb.13 for ; Fri, 25 Feb 2022 12:58:13 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to; bh=4r5yQQaSHNhtmOiBULctLq+3TeXcmpwOyIGMdk0I96I=; b=Taz3yppnrjcQHhPnHEl7UUdtlx0jgYMFpWbKd+tV3RrrnvBwT1xoa10u3bcbY+aw6q DwKzJ2JGkJVhIloPapc+ROf5KCBXULCCXVMqBcS+KCN+55QjqkU+vJfFfdAboD0o3awb jdklXyAZBt17BLW+MYDdAmepIa20+pAuiKyak= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to; bh=4r5yQQaSHNhtmOiBULctLq+3TeXcmpwOyIGMdk0I96I=; b=y7dDMe/att4Om7MycDrdZrx2qQXeTFoRcpwSa1vRgvl171ZFh/ARAL+flzzc+XQ8qB WRWZXGmRX0z5x5ZLi1RGntxhuknNw4EGs8elECnpMGVC+Waiv0Z7Y6fISlnkn+r7wSp+ vbeBPIR4jGKQbhJABI+XM/ITIbUMymEs12yIOK2g2HXm7k88xezskv84iEQajfmKfpG3 uAaQBfREo2PK0MLNEq1UAOUlvh2+pcRgbI4zL7/t+z0rWvDOfSkKT0OF9Y2DEK6Kheng KZ8pp4pFz4+ztEbfYvhUqNUnQMP9gVu1w49NmT/l3ikq54cIN+loTbhyMLY73K1thETF UGlg== X-Gm-Message-State: AOAM532rOdDPEBf/uo3L5atEqC8Um8Velwy4G0mlhV/MzGz72arQZMcQ b3HywARUlD5O78V1NfGbxUHXSw== X-Google-Smtp-Source: ABdhPJxqsr/Hfxg8zFmOiWbGBJkTmn5pZSsYzzwU1SR6HN2kfda0SoNg5f0h4TsxbKYcDYo+pyky+Q== X-Received: by 2002:a17:902:bf07:b0:150:9b8a:a14f with SMTP id bi7-20020a170902bf0700b001509b8aa14fmr4558946plb.127.1645822692580; Fri, 25 Feb 2022 12:58:12 -0800 (PST) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id c19-20020a17090ab29300b001bc13b4bf91sm10093180pjr.43.2022.02.25.12.58.12 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 25 Feb 2022 12:58:12 -0800 (PST) Date: Fri, 25 Feb 2022 12:58:11 -0800 From: Kees Cook To: Dan Li Cc: catalin.marinas@arm.com, will@kernel.org, nathan@kernel.org, ndesaulniers@google.com, masahiroy@kernel.org, tglx@linutronix.de, akpm@linux-foundation.org, mark.rutland@arm.com, samitolvanen@google.com, npiggin@gmail.com, linux@roeck-us.net, mhiramat@kernel.org, ojeda@kernel.org, luc.vanoostenryck@gmail.com, elver@google.com, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, llvm@lists.linux.dev, linux-hardening@vger.kernel.org Subject: Re: [PATCH] [PATCH v2] AARCH64: Add gcc Shadow Call Stack support Message-ID: <202202251243.1E38256F9@keescook> References: <20220225032410.25622-1-ashimida@linux.alibaba.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20220225032410.25622-1-ashimida@linux.alibaba.com> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20220225_125814_150863_5CD1CE4D X-CRM114-Status: GOOD ( 34.92 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org On Thu, Feb 24, 2022 at 07:24:10PM -0800, Dan Li wrote: > Shadow call stacks will be available in GCC >= 12, this patch makes > the corresponding kernel configuration available when compiling > the kernel with the gcc. > > Note that the implementation in GCC is slightly different from Clang. > With SCS enabled, functions will only pop x30 once in the epilogue, > like: > > str x30, [x18], #8 > stp x29, x30, [sp, #-16]! > ...... > - ldp x29, x30, [sp], #16 //clang > + ldr x29, [sp], #16 //GCC > ldr x30, [x18, #-8]! > > Link: https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=ce09ab17ddd21f73ff2caf6eec3b0ee9b0e1a11e > > Signed-off-by: Dan Li Thanks for the tweaks! > --- > FYI: > This function can be used to test if the shadow call stack works: > //noinline void __noscs scs_test(void) > noinline void scs_test(void) > { > unsigned long * lr = (unsigned long *)__builtin_frame_address(0) + 1; > > asm volatile("str xzr, [%0]\n\t": : "r"(lr) : "x30"); > } Not a big deal, but just FYI, there's a lot of whitespace trailing the "}" above... > > ffff800008012770 : > ffff800008012770: d503245f bti c > ffff800008012774: d503233f paciasp > ffff800008012778: f800865e str x30, [x18], #8 > ffff80000801277c: a9bf7bfd stp x29, x30, [sp, #-16]! > ffff800008012780: 910003fd mov x29, sp > ffff800008012784: 910023a0 add x0, x29, #0x8 > ffff800008012788: f900001f str xzr, [x0] > ffff80000801278c: f85f8e5e ldr x30, [x18, #-8]! > ffff800008012790: f84107fd ldr x29, [sp], #16 > ffff800008012794: d50323bf autiasp > ffff800008012798: d65f03c0 ret > > If SCS protection is enabled, this function will return normally. > If the function has __noscs attribute (scs disabled), it will crash due to 0 > address access. It would be cool to turn this into an LKDTM test... (see things like the CFI_FORWARD_PROTO test). I imagine this should be CFI_BACKWARD_SHADOW or something... Also, I assume you're using real hardware to test this? It'd be nice to see if qemu can be convinced to run with the needed features. Whenever I've tried this it becomes impossibly slow. :) > > arch/Kconfig | 19 ++++++++++--------- > arch/arm64/Kconfig | 2 +- > include/linux/compiler-gcc.h | 4 ++++ > 3 files changed, 15 insertions(+), 10 deletions(-) > > diff --git a/arch/Kconfig b/arch/Kconfig > index 678a80713b21..c92683362ac2 100644 > --- a/arch/Kconfig > +++ b/arch/Kconfig > @@ -599,21 +599,22 @@ config STACKPROTECTOR_STRONG > config ARCH_SUPPORTS_SHADOW_CALL_STACK > bool > help > - An architecture should select this if it supports Clang's Shadow > - Call Stack and implements runtime support for shadow stack > + An architecture should select this if it supports the compiler's > + Shadow Call Stack and implements runtime support for shadow stack > switching. > > config SHADOW_CALL_STACK > - bool "Clang Shadow Call Stack" > - depends on CC_IS_CLANG && ARCH_SUPPORTS_SHADOW_CALL_STACK > + bool "Shadow Call Stack" > + depends on ARCH_SUPPORTS_SHADOW_CALL_STACK > depends on DYNAMIC_FTRACE_WITH_REGS || !FUNCTION_GRAPH_TRACER > help > - This option enables Clang's Shadow Call Stack, which uses a > - shadow stack to protect function return addresses from being > - overwritten by an attacker. More information can be found in > - Clang's documentation: > + This option enables the compiler's Shadow Call Stack, which > + uses a shadow stack to protect function return addresses from > + being overwritten by an attacker. More information can be found > + in the compiler's documentation: > > - https://clang.llvm.org/docs/ShadowCallStack.html > + - Clang (https://clang.llvm.org/docs/ShadowCallStack.html) > + - GCC (https://gcc.gnu.org/onlinedocs/gcc/Instrumentation-Options.html#Instrumentation-Options) > > Note that security guarantees in the kernel differ from the > ones documented for user space. The kernel must store addresses > diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig > index 09b885cc4db5..b7145337efae 100644 > --- a/arch/arm64/Kconfig > +++ b/arch/arm64/Kconfig > @@ -1255,7 +1255,7 @@ config HW_PERF_EVENTS > config ARCH_HAS_FILTER_PGPROT > def_bool y > > -# Supported by clang >= 7.0 > +# Supported by clang >= 7.0 or GCC >= 12.0.0 > config CC_HAVE_SHADOW_CALL_STACK > def_bool $(cc-option, -fsanitize=shadow-call-stack -ffixed-x18) > > diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h > index ccbbd31b3aae..deff5b308470 100644 > --- a/include/linux/compiler-gcc.h > +++ b/include/linux/compiler-gcc.h > @@ -97,6 +97,10 @@ > #define KASAN_ABI_VERSION 4 > #endif > > +#ifdef CONFIG_SHADOW_CALL_STACK > +#define __noscs __attribute__((__no_sanitize__("shadow-call-stack"))) > +#endif I initially wondered if we need a separate __no_sanitize(STUFF) patch to make the compiler-clang.h macros easier, but I see there are places where we do multiple ("address", "hwaddress") and have specialized macros, so I think this is fine. And since GCC doesn't support "__has_feature", I think this is the correct location for this. > + > #if __has_attribute(__no_sanitize_address__) > #define __no_sanitize_address __attribute__((no_sanitize_address)) > #else > -- > 2.17.1 > Reviewed-by: Kees Cook -- Kees Cook _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel